CVE-2026-128241

The xmlwf tool in libexpat (versions through 2.10.0) contains a symlink following vulnerability. The issue arises because the -d output mode opens files using fopen("wb"), which follows symbolic links. A local attacker with write access to the output directory can plant a symlink at the expected ...

CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

CVE-2026-125339

Winter CMS versions 1.0.319 through 1.2.13 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw because Backend\Classes\Controller::actionExists() allows public handler-shaped methods to be invoked via top-level GET requests. Since the system uses Route::any, CSRF validation is bypassed for...

CVE-2026-125339

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

CVE-2026-125339 Winter CMS: CSRF through AJAX handler names reachable as backend page actions

Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151141)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151141 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs...

CVE-2026-103939

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

EUVD-2026-117774

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-103939

Prior to version 8.3.0 , OpenEMR is vulnerable due to a lack of ACL and CSRF checks in the interface/modules/custom_modules/oe-module-weno/scripts/file_download.php script. When the Weno module is enabled, the default GET path triggers PharmacyService::removeWenoPharmacies(), which can be execute...

CVE-2026-103939 OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-103939 OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-99241

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

CVE-2026-99241

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

UBUNTU-CVE-2026-99241

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

CVE-2026-99241

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

EUVD-2026-115283

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

CVE-2026-99241

The Linux kernel contains a vulnerability in the ntfs filesystem driver where ntfs_filemap_page_mkwrite() fails to hold the mapping->invalidate_lock. This omission allows a race condition during concurrent truncate or fallocate operations, as the driver may map blocks and dirty the folio while...

CVE-2026-99241 ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

CVE-2026-99241 ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

Linux Distros Unpatched Vulnerability : CVE-2026-99241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls...